There is no single official "HIPAA form." A HIPAA release (the rule calls it an authorization) lets a doctor share your health information with the people you name. Each doctor's office, hospital and insurer uses its own, so you sign one at each place. Making decisions for someone is a different document: a health care agent, named in an advance health care directive.
When a doctor can talk to family without a form
- You're there and say it's fine, or you don't object, or the doctor reasonably infers you don't: the doctor may share what is directly relevant to the family member's part in your care.
- You're not there, or can't decide, as in an emergency: the doctor may use professional judgment to share what is directly relevant, for example letting someone pick up a prescription.
- Everything else (phone calls when you aren't on the line, copies of records, the patient portal, the insurance company) usually takes a signed release on file.
HIPAA Privacy Rule, 45 CFR 164.510(b).
What a valid HIPAA release has to say
- What information can be shared, described specifically.
- Who may share it (the doctor, hospital or plan).
- Who may receive it (you, by name).
- Why. "At the request of the individual" is enough when the patient asks for it.
- When it expires: a date or an event.
- The patient's signature and the date. A personal representative who signs also describes their authority.
It must also say the patient can revoke it in writing. If an office hands you a form missing any of these, ask for theirs again.
Your 18-year-old, or a college student
At 18, a parent stops being the automatic "personal representative." HIPAA treats a parent as the representative of a minor; for an adult, it's whoever has legal authority to make their health care decisions, such as an agent they named in an advance health care directive.
- Your student signs a release naming you at their own doctor and at the campus health center, on each one's form.
- For decisions if they ever can't speak for themselves: an advance health care directive naming you as agent. That's a legal document; see below.
- Keep copies on both your phones.
An aging parent
- Each doctor and hospital: their own release, naming you. Keep a list of every office, phone number and medication.
- Medicare: form CMS-10106, "Authorization to Disclose Personal Health Information," lets 1-800-MEDICARE talk to you. The form (CMS.gov).
- Decisions: an advance health care directive naming you (and an alternate) as agent. The California Attorney General says there is no required form (Probate Code section 4701), and to give copies to the agent, the doctor, the hospital and trusted family.
Helping from another state? Everything to set up from far away.
California Attorney General, Advance Care Planning.
Where PJ comes in
PJ rounds up every office's release form and Medicare's CMS-10106, fills in the names, dates and offices with you, gets them signed, and delivers each one back by portal, fax or in person, then keeps the list. Family Assist, $30 an hour, usually one visit. Advance directives and powers of attorney are legal documents: an attorney's job, not PJ's.
Text PJ · senior benefits checkup · Parent Check-In Plan
Sources: HIPAA Privacy Rule (eCFR, current), 45 CFR 164.502(g), 164.508(c), 164.510(b) · California Attorney General, Advance Care Planning. Checked October 10, 2026. Not legal advice. Run a practice? HIPAA-compliant AI, texting and phone tools.
Need a human?
This page is built every morning from public data by SideGuy, run by PJ, a local in Solana Beach. If something looks off, or you want a hand with your plans, text PJ at 858-461-8054. A real person answers.
Local help, free to read: make your fix plan · senior benefits checkup · lower your SDG&E bill · Medicare Extra Help · every 2027 Medicare plan · is my medication recalled? · the next 90 days. Plans start as low as $25. Your parent lives here and you don't? The Parent Check-In Plan, $25 a month.
Questions people ask
Is there an official HIPAA form for family members?
No single one. Each doctor's office, hospital and insurer uses its own authorization form; the HIPAA rule sets what a valid one must include.
Do I need a HIPAA form for my 18-year-old?
To get their information when they aren't there, usually yes. At 18 a parent is no longer automatically their personal representative under HIPAA, so they sign a release naming you at their doctor and campus health center.
Can a doctor talk to my family without a HIPAA form?
Sometimes. If the patient is there and agrees or doesn't object, or can't decide in an emergency, HIPAA lets the doctor share what's directly relevant to the family member's part in their care.
What has to be on a HIPAA release form?
What's shared, who shares it, who receives it, the purpose, an expiration date or event, and the patient's signature and date, plus a statement that it can be revoked in writing.
Is a HIPAA release the same as a health care power of attorney?
No. A release lets someone receive information. Making decisions takes a health care agent named in an advance health care directive, which is a legal document.
How do I cancel a HIPAA authorization?
In writing, to the office that has it. The rule requires the form to say it can be revoked in writing.
Know someone who needs this?
Got a question about this? Ask PJ a question. A real person in Solana Beach texts you back.
Something changed here? Text PJ the fix: if it changes this page, you get $5. How it works.
Spotted something new around town? Text it in. What do you want to see here? Ask PJ for a page. No login, a real person reads it.
More free local tools: the North County toolkit.